It’s 2023, why are websites actively preventing pasting into fields like passwords and credit card number boxes? I use a password manager for security, it’s recommended by my employer to use one, and it even avoids human error like accidentally fat-fingering keys, and best of all with the credit card number I don’t have to memorize anything or know a single digit/character!
I have to use the Don’t Fuck With Paste addon just to be able to paste my secrets into certain monthly billing websites; why is my electric provider and one of my banks so asinine that pasting cannot be allowed? I can only imagine downsides and zero upsides to this toxic dark-pattern behavior.
There is even a mention about this in NIST SP 800-63B, a standard for identity management that some companies must follow in the USA, which mentions forcefully rotating passwords and denying “password paste-in” as antiquated/bad advice:
Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets
Edit: I discovered that for Firefox users there’s a simpler way than exposing your secrets to someone’s third-party addon. Simply open about:config, search for dom.event.clipboardevents.enabled, and change it from true to false.
Edit 2: As some have pointed out, that config value interferes with regular functionality on some sites. Probably best to leave it alone unless you know what you’re doing.
You must log in or register to comment.
You think this is bad? Up until a couple of months ago, the US treasury website forced you to use an on-screen keyboard to enter your password.
I have a Keyboard Maestro command to type out the clipboard instead of pasting it. Some developers just love exerting control over everything. I’m sure this one is done in the name of security, which is silly.
You do realize that any program can access the clipboard right? Having your private information copied in the clipboard completely defeats the entire purpose of security.
Might as well put your private info on a bumper sticker for all to see.
Agree. It is a stupid and antiquated idea. Two things I’d like to say though:
One: you can probably set up some form of auto-type from your password manager to get around this issue.
Two: blocking pasting is probably because password managers and operating systems must be secure when it comes to the clipboard, and clipboard management. Because if that’s not safe, your passwords you are copying and pasting are not safe.
